Alternative Block Chains : be safe!

(1/348) > >>

Gavin Andresen:
I haven't seen anybody post about what would be my biggest worry if I were trying out alternative block chains. I realize this may be perceived as "Gavin is FUD'ding anything that isn't bitcoin!" (FUD == Fear, Uncertainty and Doubt) But I think some of you might be forgetting some basic computer security fundamentals in the excitement to be early adopters.

When I first heard about bitcoin, my questions were:

1) Can it possibly work (do the ideas for how it works make sense)?
2) Is it a scam?
3) If it is not a scam, could it open my computer up to viruses/trojans if I run it?

I answered those questions by:

1) Reading and understanding Satoshi's whitepaper. Then thinking about it for a day or two and reading it again.
2) Finding out everything I could about the project. I read every forum thread here (there were probably under a hundred threads back then) and read Satoshi's initial postings on the crypto mailing list.
3) Downloaded and skimmed the source code to see if it looked vulnerable to buffer overflow or other remotely exploitable attacks.

If I were going to experiment with an alternative block-chain, I'd go through the same process again. But I'm an old conservative fuddy-duddy.

If you want to take a risk on a brand-new alternative block-chain, I'd strongly suggest that you:

1) Run the software in a virtual machine or on a machine that doesn't contain anything valuable.
2) Don't invest more money or time than you can afford to lose.
3) Use a different passphrase at every exchange site.

Lolcust:
Thank you Gavin.

The only things I might add is that "use a different password" isn't limited to exchanges, but applies to forums, emails, and even pools ;) , and that some antivirus heuristics seem to hate anything that has mining code in it and isn't explicitly whitelisted.

makomk:
Also, don't believe everything that prominent members of the Bitcoin community have to say about alternative chains. In particular, I know some people think that the number of confirmations doesn't matter and all that matters is the total expected time of the confirmations, so that 1 10-minute-average confirmation is more secure than 3 3-minute-average confirmations. If you read Satoshi's paper it's clear this isn't true; the number of confirmations is actually more important because transaction security increases exponentially with more confirmations. (His paper has approximate figures; you'll notice that accepting 1 and 2-confirmation transactions is fairly risky.)

bitlotto:
Good advice.

Using an alternate cryptocurrency client would be a great way to get many people to install a hidden virus that targets Bitcoin users.

If you have a significant amount of Bitcoins, I wouldn't run other clients on the same computer until the alternates have developed trust over a longer period of time... I'm probably on the paranoid side of things though.

These new cryptocurrencies are interesting, and it will be fascinating to see how it will all play out.

Lolcust:
Generally, if you have a large amount of bitcoins on a given PC, being extra-cautious about third party software (be it an Alt-coin client or a particularly fancy casual game) is advisable.

Navigation

 Message Index